Security audit and hardening

[copyleftdev]

Depends on: #29

Security review:

• Review all invariants enforced
• Check integer overflow
• Verify signature validation everywhere
• Review timing attacks
• Run sanitizers (ASan, UBSan)

Acceptance:

• All invariants verified
• No sanitizer warnings
• No timing attacks
• Security checklist complete